What is CVE-2026-126062?

CVE-2026-126062 is a low-severity vulnerability in Sparklemotion Nokogiri, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 3.7/10. Published 2026-11-10.

How severe is CVE-2026-126062?

Low severity. CVSS v3 base score is 3.7 out of 10.

XXE in Sparklemotion Nokogiri

CVE-2026-126062

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.

Vulnerability class: XXE (XML External Entity)

Published 2026-11-10.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Sparklemotion Nokogiri — versions < 1.19.5

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-126062?: CVE-2026-126062 is a low-severity vulnerability in Sparklemotion Nokogiri, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 3.7/10. Published 2026-11-10.
How severe is CVE-2026-126062?: Low severity. CVSS v3 base score is 3.7 out of 10.